Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Please don't add any of my stuff to this project”

github.com

Post reply on HN
Print view View original

241–250 of 363 posts

Re: “Please don't add any of my stuff to this project”

#241

Post by aequitas »

Firehawke wrote: post #239

Well, Home Assistant's handling of this is well-timed. I was just looking at the possibility of redoing my openHAB config in HA but this makes it really clear I don't want to go within a 150 mile radius of HA.

I've been using HA a lot in the past and written some components. But a while back they moved away from allowing pure YAML configurations and required some components to do setup via the GUI only. So it's not longer trivial to make a immutable deployment of HA since you will always need to manually make adjustments afterwards.

Re: “Please don't add any of my stuff to this project”

#242

Post by geoah »

waiseristy wrote: post #193

"Slightly assholic at first sight" kind of tells you all you need to know about how this developer will go about solving community problems.

^ this is actually in the author's github profile. You can't make this shit up.

https://github.com/frenck

> Slightly assholic at first sight Actually a nice guy that just likes to get stuff done. @home-assistant Herder @hassio-addons Creator

Re: “Please don't add any of my stuff to this project”

#243

Post by NathanKP »

pas wrote: post #195
NathanKP wrote: post #123

Earlier quoted context omitted.

Yeah I really wouldn't want to use anything that dynamically pulls a package from PyPI at runtime, because I don't trust this guy not to add a vulnerability to the code at a later point in time.

Okay, so ... I know someone might, but really who will audit any of his existing code? (Sure, that's slightly different than identifying such an auto-update point and then trying to do a supply-chain attack. But do maintainers look at what they package? In how much detail?)

That's the point of packaging it... you review it at the time that you package it, and then you review it each time you update it in the future. Should always do a simple diff at minimum to see what changed. That's just part of being a responsible open source user.

Re: “Please don't add any of my stuff to this project”

#244

Post by mijoharas »

jchw wrote: post #86
TheChaplain wrote: post #44

Earlier quoted context omitted.

Legally yes they are allowed and can ignore the author as they like. They can also act as a bigger person and say "Sure, we understand, respect your wish and will find an alternative."

It's being added as a dependency to home assistant, a popular package, so they are pretty much between a rock and a hard place. Ultimately, if the author of the code doesn't want it redistributed by distributions, I assume home assistant will have to remove it from upstream. It might be good for someone to raise the flag with home assistant since this is apparently becoming a point of contention with two different di…

It appear this has already been done, and the founder of home assistant seems to be supporting the developer. [0]

I'm starting to get the feeling that home automation might be somewhat hostile to repackaging.

[0] https://community.home-assistant.io/t/consider-to-avoid-addi...

Re: “Please don't add any of my stuff to this project”

#245

Post by ticviking »

aequitas wrote: post #240
ticviking wrote: post #228

Earlier quoted context omitted.

If the response to someone finding and using your work is the kind of over the top demand to "don't use the thing I just released under a permissive license" with multiple replies that amount to, "Don't use the thing in a way I don't like kthanxbai" how can you depend on it?

The project is written specifically for Home assistant by a core developer, it's not a small time developer who's project got accidentally included in a major project.

I'm not sure how that's relevant.

When we release software to others under an open license we are explicitly allowing them to do exactly what nix is doing.

I'm not sure what other reason we have a component independently deployable other than to make it usable by people in other projects.

AFAICT it's kind of the opposite problem to systemd owning unrelated stuff because it's easier on those developers.

Re: “Please don't add any of my stuff to this project”

#246

Post by andrewmcwatters »

Both the comments on GitHub, and this thread are an absolutely awful look for open source, and it's feedback like this that drives excellent creators to stop creating open source projects, leaving the entire FOSS ecosystem left with half-assed solutions or hand-off maintainers who can do nothing more than nominal bugfixes once an original author leaves because of harassment.

You're entitled to nothing when authors write FOSS. They provide it as-is. Take it or leave it. No one is obligated to take support harassment.

The arguments left on GitHub are "well you chose this license" and generally, sure that's done out of good faith, but when organizations test the boundaries of an author's intent, they have no option but to relicense or dual-license.

And you know what, this isn't even unique! Tons of FOSS projects do not support alternative distributions. In fact, implicitly, virtually no one does. Most authors publish software with the expectation you'll use their distribution channels.

Re: “Please don't add any of my stuff to this project”

#247

Post by lesto »

whateveracct wrote: post #150

What's worse is this frenk guy seems to be the reason his packages are being added to nixpkgs He added the dependency himself https://github.com/home-assistant/core/pull/51645 Nobody gives a shit about frenk or his code directly here - they want to use Home Assistant. But now that frenk added his code as a dependency, he has the right to transitively make Home Assistant un-packagable on NixOS? EDIT: On top of that, t…

> Pinning every Python dependency instead of fetching HEAD is how you get local control and security!

yes it is? they make sure the user get a specific version that is (hopefully) vetted and know as working properly; this is much safer than pulling HEAD for a 3th party repo. As long as the libs are updated regularly and when security issue are found, I see no problem with this approach

> he has the right to transitively make Home Assistant un-packagable on NixOS?

Pretty sure a custom license is not compatible with the Apache 2 license of "Home Assistant"; also as the code is in use by a third party, the author should not be able to retroactively change license, only next releases. Probably will be forked or removed depending on the specific of the case and of the code.

Re: “Please don't add any of my stuff to this project”

#248

Post by steveklabnik »

mcguire wrote: post #54
steveklabnik wrote: post #15

I am reminded of jwz, debian, and xscreensaver (Not linking to jwz's blog from HN because... he doesn't want it to be.)

You might want to check what is on the other end of that link when the Referer is HN.

Did you catch me before the edit? I remembered right after I clicked "submit" and immediately removed it, ha! You must have seen it right at the right moment.

Re: “Please don't add any of my stuff to this project”

#249

Post by steveklabnik »

barbazoo wrote: post #62
steveklabnik wrote: post #15

I am reminded of jwz, debian, and xscreensaver (Not linking to jwz's blog from HN because... he doesn't want it to be.)

> Not linking to jwz's blog from HN because... he doesn't want it to be I don't think ... that's how the internet works? (edit: I mean the "because... he doesn't want it to be" part)

Sure, it's not like, a law of physics or something, but

1. in this case there's... more to it, as you've been pointed out

2. I still think it's polite to respect someone's wishes, especially when it is trivial to do so.

This attitude of "well I can because I can and what you think doesn't matter" is promoted as the culture of "the internet" by a lot of folks, but it's a cultural thing that not everyone agrees with.

Re: “Please don't add any of my stuff to this project”

#250

Post by ris »

andrewmcwatters wrote: post #246

Both the comments on GitHub, and this thread are an absolutely awful look for open source, and it's feedback like this that drives excellent creators to stop creating open source projects, leaving the entire FOSS ecosystem left with half-assed solutions or hand-off maintainers who can do nothing more than nominal bugfixes once an original author leaves because of harassment. You're entitled to nothing when authors wr…

The way an author expresses and codifies their "wishes" over redistribution is through a license. If the current license does not accurately reflect the author's "wishes", it should be amended. Otherwise it is bogus to declare that this software is under the MIT license.

Having the author's wishes expressed in law ensures that all users can receive equal, non-discriminatory and predictable treatment, rather than having to walk on eggshells around what an author may or may not like you doing.

Post reply on HN